1
Enter a Domain Name
Enter a domain name in the field above — for example, google.com or your own domain.
SPF Lookup |
Find the Sender Policy Framework record for any domain — see authorized mail servers, mechanisms, and sending policy.
More Tools
SPF Lookup — What It Returns
An SPF record is a DNS TXT record that starts with v=spf1 and lists the servers allowed to send email for a domain. This tool reads the domain’s TXT records live and shows the SPF one.
SPF lookup queries a domain's DNS TXT records to retrieve the Sender Policy Framework record
— the policy string that identifies which mail servers are authorized to send email on
the domain's behalf. As defined in RFC 7208, every valid SPF record begins with the version
tag v=spf1, followed by mechanisms that list authorized senders (ip4, ip6,
include, a, mx) and a qualifier that defines what happens to unlisted senders (-all, ~all).
Receiving mail servers perform this lookup automatically on every inbound email to verify
the sending server's authorization before deciding whether to deliver, flag, or reject the message.
| Field | Value |
|---|---|
| DNS Record Type Queried | TXT (per RFC 7208 — the legacy SPF type 99 is deprecated) |
| Record Prefix | v=spf1 (required — identifies the record as an SPF policy) |
| RFC Governing SPF | RFC 7208 (January 2014, supersedes RFC 4408) |
| Maximum DNS Lookups Allowed | 10 per evaluation (include, a, mx, ptr, exists count toward limit) |
| Maximum SPF Records per Domain | Exactly 1 (two records = PermError, authentication fails) |
How to Use the SPF Lookup Tool
Check the SPF record for any domain in seconds — no account required.
2
Select a DNS Resolver
Select a DNS resolver. Choose Authoritative DNS to query the domain's own name servers directly for the most current result.
3
Click Lookup SPF Record
Click "Lookup SPF Record." The tool queries DNS TXT records and returns the entry beginning with v=spf1.
4
Read the SPF Policy String
Read the SPF policy string in the Value column. Each mechanism — ip4, include, mx — lists which servers are authorized to send email.
5
Check the Qualifier Flag
Check the qualifier at the end of the record. -all means strict rejection of unlisted senders; ~all means soft fail.
What the SPF Record Value Means
Read an SPF record from left to right: each mechanism (ip4, include, a, mx…) authorizes senders, and the final all says what to do with everyone else (-all reject, ~all soft fail).
The Value column in the result shows the raw SPF policy string. Here is how to read it:
| Mechanism | Meaning | Example |
|---|---|---|
ip4:x.x.x.x/nn |
Authorizes a specific IPv4 address or CIDR block to send email | ip4:203.0.113.0/24 |
ip6:xxxx::/nn |
Authorizes a specific IPv6 address or prefix | ip6:2001:db8::/32 |
include:domain |
Delegates authorization to the SPF record of another domain — counts as one DNS lookup | include:_spf.google.com |
a |
Authorizes the IP addresses in the domain's own A record | a |
mx |
Authorizes the IP addresses of the domain's MX servers | mx |
-all |
HardFail — all unlisted senders should be rejected | -all |
~all |
SoftFail — unlisted senders accepted but flagged as suspicious | ~all |
?all |
Neutral — no policy defined for unlisted senders | ?all |
How SPF Lookup Works — Technical Details
A receiving mail server looks up the sender domain’s SPF record and checks whether the connecting IP is authorized. RFC 7208 limits that check to 10 DNS lookups.
SPF records are published exclusively as DNS TXT records. RFC 7208 (January 2014) deprecated
the dedicated SPF DNS record type (type 99, defined in the now-obsolete RFC 4408) and requires
all implementations to publish and query SPF data as TXT records only. A valid SPF record must
begin with the version tag v=spf1. Any TXT record that does not start with
v=spf1 is ignored during SPF evaluation.
RFC 7208 limits SPF evaluation to a maximum of 10 DNS lookups across all mechanisms that
trigger further queries: include, a, mx,
ptr, and exists. Exceeding this limit returns a PermError, causing
SPF authentication to fail for all messages from the domain — identical to the outcome if
no SPF record exists at all. The ip4, ip6, and all
mechanisms do not trigger DNS lookups and do not count toward the limit.
The receiving mail server checks SPF by extracting the domain from the SMTP
MAIL FROM command (the envelope sender, also called the Return-Path), querying
its DNS TXT records, and comparing the connecting server's IP address against the policy.
SPF does not authenticate the From: header visible in email clients — only the
envelope sender address. This distinction is why SPF alone does not prevent display-name
spoofing, which is why DMARC is used in conjunction with SPF and DKIM.
This tool queries the selected resolver — Google (8.8.8.8), Cloudflare (1.1.1.1), OpenDNS (208.67.222.222), Quad9 (9.9.9.9), Yandex (77.88.8.8), or the domain's authoritative name servers — with caching disabled, returning the live record at query time.
Do it yourself
How to Look Up an SPF Record Without an Online Tool
SPF records are stored as DNS TXT records — query the TXT records for the domain and look
for the entry beginning with v=spf1. The online tool queries from a neutral
external resolver — results may differ from your local resolver due to caching.
Windows Command Prompt
nslookup -type=txt google.com
nslookup -type=txt google.com 8.8.8.8
Look for the output line starting with "v=spf1" — this is the SPF record.
Append a resolver IP (e.g. 8.8.8.8) after the domain to query a specific
DNS server. Use -type=txt, not -type=spf — the legacy SPF record
type (type 99) is deprecated and most domains do not publish it.
Windows PowerShell
Resolve-DnsName google.com -Type TXT | Where-Object { $_.Strings -match "v=spf1" }
Resolve-DnsName google.com -Type TXT -Server 8.8.8.8 | Where-Object { $_.Strings -match "v=spf1" }
The Where-Object pipe filters out all TXT records that are not SPF — useful
for domains with multiple TXT records (DKIM, DMARC, domain verification tokens).
Append -Server 8.8.8.8 to query a specific resolver.
Mac / Linux dig
dig google.com TXT | grep "v=spf1"
dig google.com TXT @8.8.8.8 | grep "v=spf1"
dig google.com TXT @1.1.1.1
dig is the preferred tool for sysadmins — it shows the full TXT record
response with TTL, response flags, and the authority section. The grep "v=spf1"
pipe isolates the SPF record from other TXT entries. On macOS, dig is
pre-installed. On Ubuntu/Debian, install it with apt install dnsutils.
Common Uses for SPF Lookup
Diagnosing email deliverability failures. A mail server admin notices
that outbound email is landing in recipients' spam folders despite a working mail server.
An SPF lookup on their domain shows the record authorizes the old on-premises mail server
IP but not the Microsoft 365 IP range added during a recent migration. Adding
include:spf.protection.outlook.com to the existing record resolves the
authentication failure and restores inbox delivery.
Investigating email spoofing during a security audit. A security analyst
investigating a phishing campaign looks up the SPF record for the domain being impersonated.
The record ends with +all — authorizing any mail server on the internet to
send as that domain. This critical misconfiguration enabled the spoofing attack. The analyst
documents the finding and contacts the domain owner to replace +all with
-all immediately.
Confirming DNS propagation after a new record is published. A webmaster
who has just migrated email to Google Workspace publishes an SPF record and waits for
propagation. They run an SPF lookup selecting Authoritative DNS to query the domain's own
name servers directly, confirming the record now reads
v=spf1 include:_spf.google.com ~all with a TTL of 3600 seconds — correctly
in place before switching mail flow to the new service.
Frequently Asked Questions
What is an SPF record?
An SPF (Sender Policy Framework) record is a DNS TXT record that lists which mail servers and IP addresses are
authorized to send email on behalf of a domain. When a receiving mail server gets an email, it queries the
sender's domain for a TXT record beginning with v=spf1 and checks whether the sending IP is included.
Defined in RFC 7208, SPF is one of three email authentication protocols alongside DKIM and DMARC.
How accurate is this SPF lookup?
The lookup returns the live record from the selected DNS resolver at query time with no caching applied.
Selecting Authoritative DNS queries the domain's own name servers directly — the most current result possible,
bypassing any recursive resolver cache. The record displayed is exactly what receiving mail servers see when
they authenticate inbound email from that domain.
Why is my SPF lookup returning no result?
Four common causes: (1) the domain has no SPF record published, which allows spoofing; (2) the record
exists but is missing the required v=spf1 version prefix; (3) SPF is configured on a parent domain but
not on the specific subdomain queried; (4) the DNS change was made recently and has not yet propagated to
the selected resolver — switch to Authoritative DNS to check the source record directly.
What is the difference between SPF SoftFail (~all) and HardFail (-all)?
The qualifier at the end of an SPF record defines what happens when the sending IP is not listed.
-all (HardFail) instructs receiving servers to reject the message outright.
~all (SoftFail) instructs servers to accept the email but flag it as suspicious — Gmail and most
providers treat SoftFail messages as spam candidates rather than hard rejections.
Most organizations use ~all until their SPF record is complete, then switch to -all.
How many SPF records can a domain have?
Exactly one. RFC 7208 explicitly prohibits publishing more than one SPF TXT record on the same domain name.
If two records beginning with v=spf1 are found, the SPF evaluation returns a PermError, which causes
authentication to fail for every message from the domain — the same outcome as having no SPF record at all.
Multiple sending services must be consolidated into a single record using include mechanisms.
Does this tool store the domains I look up?
No. SPF lookups are processed in real time and no query data is stored or logged. The domain name you
enter is used only to perform the live DNS query — it is not retained, associated with your IP address,
or shared with any third party.
Related Guides
Guide
What Is an IP Address?
Explains how IP addresses, DNS records, and domain name resolution work together — foundational context for understanding how SPF TXT records are queried during email delivery.
Guide
What Is IPv4?
Covers IPv4 address notation and CIDR blocks, relevant for reading
ip4: mechanisms in SPF records that authorize specific IPv4 ranges to send email on a domain's behalf.